PHP: The three little letters wreaking havoc across the web
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.
TL;DR
- Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were found in the PHP programming language.
- PHP is used by up to 70% of websites, including major platforms like WordPress, Wikipedia, and Drupal.
- The vulnerabilities affect nearly all versions of PHP dating back 20 years, many of which are no longer supported.
- Hackers attempted to exploit the flaws before they were patched, with thousands to millions of attack attempts reported by companies like Cloudflare.
- Several websites and services, including the Internet Archive, DeviantArt, 4chan, and two Japanese mobile games, were temporarily or permanently taken offline.
- Government agencies in the Netherlands and Finland, along with the NSA and UK's National Cyber Security Center, advised taking systems offline if immediate patching was not possible.
- AI, specifically GPT-5.6 Sol, was used by a security researcher to identify the PHP exploits, and also potentially by attackers to exploit them more easily.
- The PHP Foundation has confirmed no successful remote code execution attempts to their knowledge, but stresses the imperative to update affected systems.
- The vulnerabilities have a severity rating of 9.2 out of 10 and are classified as Remote Code Execution exploits.